01
Generate
A MITRE ATT&CK-grounded scenario, tailored to your sector. For infrastructure and smart buildings, that can be ransomware with operational-technology impact.
Introducing
Tabletop exercises
that fight back.
An AI adversary that evaluates every decision and evolves the scenario — with regulator-grade evidence at the end.
Regulation made exercising a recurring legal obligation. Static scripts don’t produce defensible evidence.
Platform
How an adaptive exercise actually runs.
02
Exercise
The AI adversary evaluates each team decision and selects the most realistic next branch. A human facilitator approves every inject before it is delivered. The AI never publishes directly to participant screens.
03
Evidence
A grounded after-action report that cites the timestamped decision ledger — ready for auditors and the board.
Who it’s for
The obligation is already live.
Financial services
DORA
DORA resilience testing, in force since January 2025, is answered with timestamped exercise evidence rather than a slide deck.
Healthcare
GDPR + NIS2
Incident-response exercising for organisations that sit under both GDPR and NIS2.
Critical infrastructure
NIS2 Art. 21
NIS2 Article 21 makes incident-response exercising a recurring legal obligation, and the ledger is the record you can defend.
MSSPs
Client delivery
A differentiated, AI-powered tabletop practice for client delivery, including white-label use under a written agreement.
Security engineered in
Built the way we’d tell you to build it.
The controls a buyer should ask for — and the ones the platform is built with. None of this is a certification.
- Tenant isolation
- Enforced at the database layer with PostgreSQL row-level security. An adversarial cross-tenant test suite gates every release.
- Event ledger
- Append-only and timestamped — database triggers reject every edit and delete. After-action reports cite it directly.
- Human in the loop
- A facilitator approves every AI inject before participants see it. The AI never publishes directly to participant screens.
- OWASP and LLM controls
- Engineered against the OWASP Top 10 and the OWASP Top 10 for LLM Applications, including delimited untrusted input and a prompt-injection test corpus run in continuous integration.
- No model training
- We never use customer exercise content to train AI models, and our AI provider's commercial terms prohibit it.
- Blocking release gates
- Secret scanning — verified by a deliberate planted-secret drill — plus static analysis, dependency vulnerability scanning, and a seven-day cooldown on newly published dependencies.
- Least privilege
- Separate database identities for migrations and runtime. The database is never exposed to the public internet.
- EU hosting
- Hosted in the European Union (Amsterdam). Encrypted in transit. AI inference is not EU-limited.
Mapped, not certified
Exercises and evidence mapped to NIS2 · DORA · FCA PS21/3 · ISO/IEC 27001
Alignment of exercise design and the evidence pack. Not a claim of certification.
Resources
What security leaders ask first.
How is this different from a scripted tabletop?
A scripted tabletop follows a fixed story no matter what the team decides. CheckmateAI evaluates every participant decision at each inject and branches the scenario from a MITRE ATT&CK-grounded set of TTPs. The after-action report is anchored to the timestamped ledger of what was actually decided.
Does the AI act on its own?
No. A human facilitator reviews and approves every AI-generated inject before participants see it. The AI never publishes directly to participant screens.
Where is our data hosted?
In the European Union — Railway's europe-west4 region (Amsterdam). Data is encrypted in transit. AI inference is processed by Anthropic and is not limited to the EU.
Is our data used to train models?
No. We never use customer exercise content to train AI models, and our AI provider's commercial terms prohibit it.
Which regulations does the evidence support?
Exercise design and the evidence pack are mapped to NIS2, DORA, FCA PS21/3, and ISO/IEC 27001. The record is a grounded, citation-anchored after-action report drawn from the append-only ledger. Mapping is not a certification, and completing an exercise does not by itself make an organisation compliant.
How long does an exercise take to set up?
An exercise is configured around a sector scenario, facilitator and participant roles, and a live run — for example, ransomware with operational-technology impact for infrastructure and smart buildings. This page does not quote a setup time. Scope and duration are agreed when you book a demo.